agents
0.29.0 · 20 Oct 2026MIT1.5M / weekRepositorynpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for agents. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 0.29.0 | No known advisory | |
| 0.28.1 | No known advisory | |
| 0.27.0 | No known advisory | |
| 0.26.0 | No known advisory | |
| 0.25.0 | No known advisory | |
| 0.24.0 | No known advisory | |
| 0.23.0 | No known advisory | |
| 0.22.0 | No known advisory | |
| 0.21.0 | No known advisory | |
| 0.20.1 | No known advisory | |
| 0.19.0 | No known advisory | |
| 0.18.0 | No known advisory | |
| 0.17.4 | No known advisory | |
| 0.16.2 | No known advisory | |
| 0.15.0 | No known advisory | |
| 0.14.5 | No known advisory | |
| 0.13.3 | No known advisory | |
| 0.12.4 | No known advisory | |
| 0.11.9 | No known advisory | |
| 0.10.2 | No known advisory | |
| 0.9.0 | No known advisory | |
| 0.8.7 | No known advisory | |
| 0.7.9 | No known advisory | |
| 0.6.0 | No known advisory | |
| 0.5.1 | No known advisory | |
| 0.4.1 | No known advisory | |
| 0.3.10 | Safe from 0.3.10 | |
| 0.2.35 | 3 open advisories, worst moderate | |
| 0.1.6 | 6 open advisories, worst moderate · last release Sep 2025, no longer updated |
- ModerateCloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground siteGHSA-w5cr-2qhr-jqc5 · 13 Feb 2026
- 0.3.x0.3.0 – 0.3.9Fixed in 0.3.10
- 0.2.x0.2.0 – 0.2.35No fix on 0.2.x · move to 0.3.10
- 0.1.x and older0.0.1 – 0.1.6No fix, no longer updated · move to 0.3.10
- ModerateCloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handlerGHSA-cvhv-6xm6-c3v4 · 13 Feb 2026
- 0.3.x0.3.0 – 0.3.9Fixed in 0.3.10
- 0.2.x0.2.0 – 0.2.35No fix on 0.2.x · move to 0.3.10
- 0.1.x and older0.0.1 – 0.1.6No fix, no longer updated · move to 0.3.10
- ModerateCloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email RoutingGHSA-r7x9-8ph7-w8cg · 3 Feb 2026
- 0.3.x0.3.0 – 0.3.6Fixed in 0.3.7
- 0.2.x0.2.0 – 0.2.35No fix on 0.2.x · move to 0.3.7
- 0.1.x and older0.0.1 – 0.1.6No fix, no longer updated · move to 0.3.7
Registry facts last checked 22 Oct 2026. Releases and advisories last read 22 Oct 2026.